Mitigation Techniques 2.5

Question 1

Patching

Answer 1

• replacement code
• Designed to correct problems or vulnerabilities.
• A way to prevent an attack.

Question 2

Encryption

Answer 2

• Securing data on another system.
• Prevent access to application data files.

Question 3

Encrypted File System (EFS)

Answer 3

• Security feature of Windows.
• Enables transparent encryption/decryption of files on the system.

Question 4

Full Disk Encryption (FDE)

Answer 4

• Encrypting an entire disk
• Protects all the contents in the container.

Question 5

Application Data Encryption

Answer 5

• Encryption is managed by the app.
• Stored data is protected.

Question 6

Monitoring

Answer 6

• A way to identify security events.
• Aggregrate information from devices
• Built-in or external to a device.

Question 7

Sensors

Answer 7

• Capture data and act upon it.
• Can report what is observed.
• Can use multiple readings to match a pattern and create an event.
• Act based on proscribed rules.

Question 8

Network Based Sensors

Answer 8

• Provide coverage across multiple machines.
• Limited by traffic engineering systems that packets pass them.
• Analysis is limited in their ability to make precise decisions on content.

Question 9

Host-Based Sensors

Answer 9

• Provide more specific and accurate information in relation to what the host machine is seeing and doing.
• Limited to just that host.

Question 10

Collectors

Answer 10

• Sensors, or concentrators that combine multiple sensors.
• Collect data for processing by other systems.

Question 11

Examples of Collectors

Answer 11

• Proprietary consoles, SIEM consoles, syslog servers

Question 12

Security Information and Event Management SIEM

Answer 12

• Collects, aggregates, and applies pattern matching to the volumes of data.
• Turns the tables of data into meaningful actionable information.
• A central source of monitoring data.

Question 13

Least Privilege

Answer 13

• Giving users access to information and systems they need to perform their duties.
• Rights and permissions are set to the bare minimum.
• Limits the scope of malicious behavior.

Question 14

Configuration Enforcement

Answer 14

• Enforces the configuration of a system logging onto the network.
• Checks if the OS is up to date on firewalls, antivirus software, and other security features

Question 15

If System is Out-of-Date According to Configuration Enforcement Procedures

Answer 15

• Systems are quarantined.
• Brought to a private VLAN with limited access to bring the system up to date.
• Recheck the system after making corrections.D

Question 16

Decomissioning

Answer 16

• Mostly associated with storage devices such as Hard Drives, SSDs, and USB Drives.
• The event of a system or device is no longer needed.

Question 17

Other Options Before Decomissioning

Answer 17

• Recycle the device to use in another system.
• Destroy the device completely.